feat: add ecr remote repository provider

[guilhermebr]

Fixes #55.

Amazon ECR does not create repositories on first push, so with tsuru's
repository-per-app image naming every new app's deploy fails with an opaque
404 Not Found at the push step. This adds an ecr provider to the existing
remote repository providers framework, alongside the oci provider (ECR and
OCIR share the no-create-on-push behavior).

Enable it via the existing REMOTE_REPOSITORY_PATH config file:

{
  "123456789012.dkr.ecr.us-east-1.amazonaws.com": {
    "provider": "ecr"
  }
}

Design/behavior:

• Credentials: AWS SDK default chain (IRSA / instance profile / env) — the
  same ambient credentials docker-credential-ecr-login uses for the push.
  The identity needs ecr:CreateRepository on the repository prefix (example
  policy in the README section this PR adds).
• Region: optional "region" config key; falls back to the region embedded
  in the ECR hostname (standard and FIPS forms), then to SDK defaults.
• RepositoryAlreadyExists = success — repeat deploys are a no-op; other
  errors fail the deploy early with the repository name in the message
  (consistent with the oci provider's failure mode), instead of buildkit's
  opaque 404 later.
• Repository settings: created with ECR defaults, no scanning/lifecycle
  opinions. Operators who want specific settings can pre-create repositories
  with their IaC tooling — the provider treats existing repositories as
  success, so both workflows compose.
• Dependency: aws-sdk-go-v2 (config + ecr), following the precedent of
  oci-go-sdk for the oci provider.
• Concurrency: the provider's lazy AWS client init is mutex-guarded —
  deploys run concurrently (one goroutine per gRPC Build), and the race
  detector confirmed a data race without the guard (test included). Heads-up:
  the oci provider's lazy auth() has the same latent race; happy to send a
  follow-up PR mirroring this fix if you agree.
• Scope note: image deletion on ECR (tsuru's registry GC uses the
  Distribution v2 API, which ECR doesn't support for deletes) is a separate
  concern in tsuru's registry package — not addressed here.

Also adds a README section documenting the remote repository providers feature
(config format, ecr + oci examples, IAM snippet) — it was previously
undocumented.

Tests: testify unit tests with a fake ECR client (create, already-exists,
error propagation, image-reference parsing incl. FIPS hosts / nested paths /
tags / digests, provider registration, and the concurrency test above).

Validated in production: running on an EKS cluster with IRSA — new apps'
repositories are auto-created on first deploy; pre-existing repositories
deploy unchanged.